vCenter cloud account certificate validation loops indefinitely in VMware Aria Automation

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In VMware Aria Automation, when you attempt to validate a vCenter cloud account after a certificate rotation or expiration, the UI popup to trust the certificate loops indefinitely. The validation appears to succeed in the UI, but the save action never persists, leaving the cloud account stuck in a failed state.

You will observe the following error in the provisioning-service-app.log (located at /var/log/services-logs/prelude/provisioning-service-app/provisioning-service-app.log):

{"message":"Error storing certificate. Retry validation","statusCode":400,...}

Additionally, the endpoint health check displays a failure due to an expired certificate, even if the new leaf certificate is valid:

FAILED with NotAfter: Wed Jul 22 18:06:15 GMT 2026 for vCenter https://vCenterHostName/sdk

Environment

• VMware Aria Automation 8.x

• VMware vSphere 8.x

Cause

This issue occurs because the vCenter server presents a certificate chain that bundles an unrelated, expired intermediate certificate during the TLS and credential validation. Even if the leaf certificate is valid, the presence of the expired intermediate certificate (a leftover from a previous PKI hierarchy) causes the Aria Automation trust-document store to reject the certificate payload.

Resolution

To resolve this issue, you must remove the expired intermediate certificate from the vCenter server.

1. Log in to the affected vCenter server.

2. Rebuild the certificate chain in the vCenter Endpoint Certificate Store (VECS) and ensure the client certificate assigned to vCenter is signed by the new unexpired Issuer / root.

3. Strip out the old, expired intermediate certificate (e.g., IssuingG2V1) from the chain.

4. Return to the VMware Aria Automation UI and validate the cloud account again to accept the corrected certificate chain.

Additional Information

This specific issue is not resolved by running the standard Aria Automation Orchestrator workflow for updating cloud account certificates, as the problem lies within the certificate chain presented by vCenter itself.